Win.Desktop.Puzzle

Details

Summary

This is a trojan written in Delphi. The original filename is SLIDESCR.EXE. When executed
under Windows 95 it blocks task manager and opens a messagebox with the following
text:

Slider 1.0 Oops, looks like somebody doesn't like you very much ! You have to finish this sliding tile puzzle before you can continue whatever it is you're doing ! Use the cursor keys to move the pieces (black piece is the empty one).

Removal

Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More

More information on scanning and removal options available in your F-Secure product
can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

For further assistance, F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.

Technical Details

After 'OK' is pressed the trojan splits Windows desktop into several parts, mixes
them and waits for the user to restore the original desktop by solving the sliding
tile puzzle. It also swaps functions of cursor keys: 'Up' becomes 'Down', 'Left'
becomes 'Right' and that makes solving the puzzle more difficult. There's no way to
continue working with other Windows applications until you complete the puzzle.

Under Windows NT the task manager is not blocked by the trojan and the puzzle task
could be killed.

If the trojan is executed from DOS session (full screen mode) the desktop data is
not acquired correctly and the puzzle parts are blank. This happens because the desktop
image is acquired by the trojan before Windows switches from DOS screen to its desktop.

Technical Details:Alexey Podrezov, F-Secure

SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis